{"id":"CVE-2022-31257","aliases":["EUVD-2022-52834","GHSA-x6gc-63rj-4gw6"],"status":"published","title":"A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \u003c V7.23...","description":"A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \u003c V7.23.31), Mendix Applications using Mendix 8 (All versions \u003c V8.18.18), Mendix Applications using Mendix 9 (All versions \u003c V9.14.0), Mendix Applications using Mendix 9 (V9.12) (All versions \u003c V9.12.2), Mendix Applications using Mendix 9 (V9.6) (All versions \u003c V9.6.12). In case of access to an active user session in an application that is built with an affected version, it’s possible to change that user’s password bypassing password validations within a Mendix application. This could allow to set weak passwords.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00795,"percentile":0.56732,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-284"],"published":"2022-07-12T10:06:43Z","modified":"2026-06-17T04:45:14Z","products":[{"vendor":"mendix","product":"mendix"},{"vendor":"siemens","product":"mendix applications using mendix 7"},{"vendor":"siemens","product":"mendix applications using mendix 8"},{"vendor":"siemens","product":"mendix applications using mendix 9"},{"vendor":"siemens","product":"mendix applications using mendix 9 (v9.12)"},{"vendor":"siemens","product":"mendix applications using mendix 9 (v9.6)"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-433782.pdf","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31257"},{"url":"https://github.com/advisories/GHSA-x6gc-63rj-4gw6"}],"sources":{"cve":[{"id":"CVE-2022-31257","description":"A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \u003c V7.23.31), Mendix Applications using Mendix 8 (All versions \u003c V8.18.18), Mendix Applications using Mendix 9 (All versions \u003c V9.14.0), Mendix Applications using Mendix 9 (V9.12) (All versions \u003c V9.12.2), Mendix Applications using Mendix 9 (V9.6) (All versions \u003c V9.6.12). In case of access to an active user session in an application that is built with an affected version, it’s possible to change that user’s password bypassing password validations within a Mendix application. This could allow to set weak passwords.","status":"published","published":"2022-07-12T10:06:43Z","modified":"2024-08-03T07:11:39.898Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:34.940806Z"}],"euvd":[{"id":"EUVD-2022-52834","description":"A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \u003c V7.23.31), Mendix Applications using Mendix 8 (All versions \u003c V8.18.18), Mendix Applications using Mendix 9 (All versions \u003c V9.14.0), Mendix Applications using Mendix 9 (V9.12) (All versions \u003c V9.12.2), Mendix Applications using Mendix 9 (V9.6) (All versions \u003c V9.6.12). In case of access to an active user session in an application that is built with an affected version, it’s possible to change that user’s password bypassing password validations within a Mendix application. This could allow to set weak passwords.","status":"published","published":"2022-07-12T10:06:43Z","modified":"2024-08-03T07:11:39Z","updated_at":"2026-11-03T03:25:34.735493Z"}],"ghsa":[{"id":"GHSA-x6gc-63rj-4gw6","title":"A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \u003c V7.23...","description":"A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \u003c V7.23.31), Mendix Applications using Mendix 8 (All versions \u003c V8.18.18), Mendix Applications using Mendix 9 (All versions \u003c V9.14.0), Mendix Applications using Mendix 9 (V9.12) (All versions \u003c V9.12.2), Mendix Applications using Mendix 9 (V9.6) (All versions \u003c V9.6.12). In case of access to an active user session in an application that is built with an affected version, it’s possible to change that user’s password bypassing password validations within a Mendix application. This could allow to set weak passwords.","status":"published","published":"2022-07-13T00:01:56Z","modified":"2023-08-02T05:02:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-269","CWE-284"],"updated_at":"2026-11-02T14:54:43.567376Z"}],"nvd":[{"id":"CVE-2022-31257","description":"A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \u003c V7.23.31), Mendix Applications using Mendix 8 (All versions \u003c V8.18.18), Mendix Applications using Mendix 9 (All versions \u003c V9.14.0), Mendix Applications using Mendix 9 (V9.12) (All versions \u003c V9.12.2), Mendix Applications using Mendix 9 (V9.6) (All versions \u003c V9.6.12). In case of access to an active user session in an application that is built with an affected version, it’s possible to change that user’s password bypassing password validations within a Mendix application. This could allow to set weak passwords.","status":"published","published":"2022-07-12T10:15:10.653Z","modified":"2026-06-17T04:45:14.43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:23.322724Z"}]}}